CVE-2026-40471 (GCVE-0-2026-40471)

Vulnerability from cvelistv5 – Published: 2026-04-23 14:56 – Updated: 2026-04-23 16:22

Title

Hackage CSRF vulnerability

Summary

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

Severity ?

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

CWE

CWE-352 - Cross-Site request forgery (CSRF)

Assigner

redhat-cnalr

References

URL

Tags

https://osv.dev/vulnerability/HSEC-2026-0002

Impacted products

	Vendor	Product	Version
			Affected: 0.1 , < * (semver)

Date Public ?

2026-03-28 19:04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40471",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T16:18:53.266261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T16:22:12.118Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://hackage.haskell.org/package/hackage-server",
          "defaultStatus": "unaffected",
          "packageName": "hackage-server",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-03-28T19:04:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts)."
            }
          ],
          "value": "hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site request forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T15:02:45.871Z",
        "orgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "shortName": "redhat-cnalr"
      },
      "references": [
        {
          "url": "https://osv.dev/vulnerability/HSEC-2026-0002"
        }
      ],
      "title": "Hackage CSRF vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
    "assignerShortName": "redhat-cnalr",
    "cveId": "CVE-2026-40471",
    "datePublished": "2026-04-23T14:56:34.979Z",
    "dateReserved": "2026-04-13T15:23:17.068Z",
    "dateUpdated": "2026-04-23T16:22:12.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40471\",\"sourceIdentifier\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"published\":\"2026-04-23T16:16:25.640\",\"lastModified\":\"2026-04-23T16:16:25.640\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"references\":[{\"url\":\"https://osv.dev/vulnerability/HSEC-2026-0002\",\"source\":\"74b3a70d-cca6-4d34-9789-e83b222ae3be\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40471\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-23T16:18:53.266261Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-23T16:19:14.233Z\"}}], \"cna\": {\"title\": \"Hackage CSRF vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0.1\", \"lessThan\": \"*\", \"versionType\": \"semver\"}], \"packageName\": \"hackage-server\", \"collectionURL\": \"https://hackage.haskell.org/package/hackage-server\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-03-28T19:04:00.000Z\", \"references\": [{\"url\": \"https://osv.dev/vulnerability/HSEC-2026-0002\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-352\", \"description\": \"CWE-352 Cross-Site request forgery (CSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"74b3a70d-cca6-4d34-9789-e83b222ae3be\", \"shortName\": \"redhat-cnalr\", \"dateUpdated\": \"2026-04-23T15:02:45.871Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40471\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-23T16:22:12.118Z\", \"dateReserved\": \"2026-04-13T15:23:17.068Z\", \"assignerOrgId\": \"74b3a70d-cca6-4d34-9789-e83b222ae3be\", \"datePublished\": \"2026-04-23T14:56:34.979Z\", \"assignerShortName\": \"redhat-cnalr\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

hsec-2026-0002

Vulnerability from osv_haskell

Published

2026-03-28 16:04

Modified

2026-03-28 16:04

Summary

Hackage CSRF vulnerability

Details

Hackage CSRF vulnerability

Vulnerable File: src/Distribution/Server/Features/Votes.hs (example)
Impact: can forge requests through XSS

To fix the issue, a new CSRF middleware checks all requests. Requests using HTTP methods other than GET, HEAD and OPTIONS are subject to a check of the Sec-Fetch-Site header, which is widely supported by modern browsers. Cross-site requests are 403 Forbidden. Certain approved and expected non-browser user agents (e.g. cabal-install/*) are exempted from the check, as are requests using token authentication (Authorization: X-ApiKey ...).

The fix has been committed and deployed on hackage.haskell.org.

Acknowledgements

Joshua Rogers (https://joshua.hu/) of AISLE (https://aisle.com/) reported the issue to the Haskell Security Response Team.
Spenser Janssen implemented the fix, and Fraser Tweedale reviewed it.
Gershom Bazerman merged the fix and deployed it to hackage.haskell.org.

References

URL

Type

https://github.com/haskell/hackage-server/commit/…

FIX

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2026/HSEC-2026-0002.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2026/HSEC-2026-0002.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "hackage-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40471"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Hackage CSRF vulnerability\n\n* Vulnerable File: `src/Distribution/Server/Features/Votes.hs` (example)\n* Impact: can forge requests through XSS\n\nhackage-server lacked Cross-Site Request Forgery (CSRF) protection\nacross its endpoints.  Scripts on foreign sites could trigger\nrequests to hackage server, possibly abusing latent credentials to\nupload packages or perform other administrative actions.  Some\nunauthenticated actions could also be abused (e.g. creating new user\naccounts).\n\nTo fix the issue, a new CSRF middleware checks all requests.\nRequests using HTTP methods other than `GET`, `HEAD` and `OPTIONS`\nare subject to a check of the [`Sec-Fetch-Site`\nheader][sec-fetch-site], which is [widely supported by modern\nbrowsers][caniuse-sec-fetch-site].  Cross-site requests are `403\nForbidden`.  Certain approved and expected non-browser user agents\n(e.g. `cabal-install/*`) are exempted from the check, as are\nrequests using token authentication (`Authorization: X-ApiKey ...`).\n\nThe fix has been [committed][commit] and deployed on\n`hackage.haskell.org`.\n\n## Acknowledgements\n\n- **Joshua Rogers** (https://joshua.hu/) of AISLE\n  (https://aisle.com/) reported the issue to the Haskell Security\n  Response Team.\n- **Spenser Janssen** implemented the fix, and **Fraser Tweedale**\n  reviewed it.\n- **Gershom Bazerman** merged the fix and deployed it to\n  `hackage.haskell.org`.\n\n[sec-fetch-site]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Site\n[caniuse-sec-fetch-site]: https://caniuse.com/?search=sec-fetch-site\n[commit]: https://github.com/haskell/hackage-server/commit/2de3ae45082f8f3f29a41f6aff620d09d0e74058\n",
  "id": "HSEC-2026-0002",
  "modified": "2026-03-28T16:04:58Z",
  "published": "2026-03-28T16:04:58Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/haskell/hackage-server/commit/2de3ae45082f8f3f29a41f6aff620d09d0e74058"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Hackage CSRF vulnerability"
}

FKIE_CVE-2026-40471

Vulnerability from fkie_nvd - Published: 2026-04-23 16:16 - Updated: 2026-04-23 16:16

Severity ?

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Summary

References

	URL	Tags
	74b3a70d-cca6-4d34-9789-e83b222ae3be	https://osv.dev/vulnerability/HSEC-2026-0002

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts)."
    }
  ],
  "id": "CVE-2026-40471",
  "lastModified": "2026-04-23T16:16:25.640",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-23T16:16:25.640",
  "references": [
    {
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
      "url": "https://osv.dev/vulnerability/HSEC-2026-0002"
    }
  ],
  "sourceIdentifier": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "74b3a70d-cca6-4d34-9789-e83b222ae3be",
      "type": "Secondary"
    }
  ]
}

GHSA-MF84-VMQG-86FM

Vulnerability from github – Published: 2026-04-23 18:33 – Updated: 2026-04-23 18:33

Details

Severity ?

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-40471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-23T16:16:25Z",
    "severity": "CRITICAL"
  },
  "details": "hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).",
  "id": "GHSA-mf84-vmqg-86fm",
  "modified": "2026-04-23T18:33:03Z",
  "published": "2026-04-23T18:33:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40471"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/HSEC-2026-0002"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-40471 (GCVE-0-2026-40471)

hsec-2026-0002

Vulnerability from osv_haskell

Hackage CSRF vulnerability

Acknowledgements

FKIE_CVE-2026-40471

GHSA-MF84-VMQG-86FM

Tags

Sightings

Nomenclature